South Korea has launched a major investigation into the ₩44.5 billion Upbit crypto hack, amid growing suspicions that the North Korean state-linked Lazarus Group may be responsible for the massive digital asset breach. The incident—one of the most significant crypto security breaches in South Korea this year—has heightened concerns over rising cyberattacks on cryptocurrency exchanges and state-backed crypto theft operations.
According to a report from Yonhap News Agency, cybersecurity investigators are analysing multiple indicators that suggest the involvement of Lazarus Group, one of the world’s most notorious and sophisticated hacking units tied to North Korea’s intelligence services. The group has been linked to several global crypto heists, ransomware campaigns, and major cyber intrusions targeting financial institutions. The FBI has previously called North Korea’s cyber operations “one of the most advanced persistent threats” in the world.
The Upbit breach, which the exchange described as an “abnormal withdrawal,” shows similarities to the 2019 Upbit hack involving ₩58 billion, which South Korean authorities later attributed to Lazarus. An unnamed government official cited by Yonhap said the patterns and techniques seen in the latest case closely resemble those used in past state-sponsored crypto thefts.
South Korea’s National Police Agency cybercrime unit confirmed that an active investigation is underway but withheld details due to the sensitive nature of the case. The National Intelligence Service (NIS) has not yet issued a public statement.
Dunamu, the operator of Upbit and one of South Korea’s largest fintech companies, said it is “currently investigating the cause and scale of the asset outflow,” adding that additional security measures are being deployed to protect user funds.
The timing of the breach has also drawn attention, occurring just hours before South Korean tech giant Naver announced plans to acquire Dunamu, marking one of the biggest moves in the country’s fintech and cryptocurrency market. Upbit continues to hold its position as South Korea’s largest cryptocurrency exchange, handling significant trading volume in a rapidly expanding digital asset ecosystem.
As authorities intensify their probe, the incident underscores the growing threats posed by North Korean cyberattacks, crypto exchange vulnerabilities, digital asset security breaches, and state-backed financial hacking campaigns—all of which have become major global cybersecurity concerns.
